High severity · published Jan 26, 2026
CVE-2026-24470
Skipper Ingress Controller Allows Unauthorized Access to Internal Services via ExternalName
8.1
CVSS
0.3%
EPSS
No
On KEV
Description
Skipper is an HTTP router and reverse proxy for service composition. Prior to version 0.24.0, when running Skipper as an Ingress controller, users with permissions to create an Ingress and a Service of type ExternalName can create routes that enable them to use Skipper's network access to reach internal services. Version 0.24.0 disables Kubernetes ExternalName by default. As a workaround, developers can allow list targets of an ExternalName and allow list via regular expressions.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 24% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SK
skipper · zalando
< 0.24.0 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-24470
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-24470
Patch
https://github.com/zalando/skipper/commit/a4c87ce029a58eb8e1c2c1f93049194a39cf6219
Mitigation
https://github.com/zalando/skipper/security/advisories/GHSA-mxxc-p822-2hx9
Product
https://kubernetes.io/docs/concepts/services-networking/service/#externalname
More from skipper
9.8
CVE-2022-38580
Zalando Skipper v0.13.236 is vulnerable to Server-Side Request Forgery (SSRF)
8.8
CVE-2026-23742
Skipper arbitrary code execution through lua filters
8.2
CVE-2026-65838
Skipper: an oversized declared-`Content-Length` body still hands OPA an empty `parsed_body`, so deny-on-presence Rego policies fail OPEN while the full payload reaches upstream
8.2
CVE-2026-65604
Skipper Incomplete Fix for CVE-2026-50197 Policy Bypass
7.8
CVE-2026-50197
Skipper: opaAuthorizeRequestWithBody filter bypasses OPA policy on Transfer-Encoding: chunked / HTTP/2 requests